linkfox-shopee-store-payment

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 skill 在运行时会把用户传入的任意 JSON 参数（如 api、shopId/merchantId、order_sn、body/queryString）经 scripts/payment_api.py → scripts/_payment_api_runner.py → developerProxy_call() 直接发送到 POST /shopee/developerProxy，并将响应 JSON 进上下文/摘要输出，因此会处理外部提交的自由文本。

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). This skill is specifically the Shopee "Payment" module and exposes Shopee payment-related APIs (escrow, payout, wallet transactions, billing, income reports). It routes requests via a developerProxy that injects shop tokens and provides scripts/endpoints (including payout and wallet APIs). Because it is a payment-specific integration (directly targeting a merchant payment API), it qualifies as direct financial execution authority per the policy.